i am trying to setup some automated response emails so I can get our helpdesk techs doing some of the repair work around here. My thought was to start monitoring for failed update/upgrades on clients. I targeted eventid's 1119 1121 1123 2201 2204 2216 2264 2402 2412. The response seems to be tripping on 2412 mostly right now. When I look at the system that generated the event it appears to be running fine and is at the latest DAT. Does anyone have any ideas or have a better way of doing this?
Event ID 2412 (Deployment failed) might be generated because there is no reason to install the software because it already exists.
In my opinion, you could be getting further by running a simple version query regularly (including proper filtering such as agent ASCI is proper and software (VirusScan?) version seems outdated, etc.) and send the result to helpdesk.
The same could be true for DAT/engine updates.